Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
Jade Sleet breached an Indian IT provider with macOS backdoors FLATROOF and ROOFDECK.
SentinelOne attributed the compromise of a smaller India-based IT services provider to North Korean actor Jade Sleet, also known as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899. The campaign used job-interview GitHub lures and weaponized Terraform lockfiles to deliver the macOS backdoors FLATROOF, also called Gaslight, and ROOFDECK. FLATROOF uses Telegram for command-and-control and can steal browser, terminal, and keychain data; ROOFDECK uses Nostr and Launch Agents. The implants were present by March 18, 2026, and the same tooling was previously tied to the KelpDAO LayerZero incident.
- Fake job GitHub repositories used malicious Terraform dependency lockfiles.
- FLATROOF uses Telegram command-and-control and steals browser and keychain data.
- ROOFDECK uses Nostr command-and-control and macOS Launch Agent persistence.
- An Indian IT provider DevOps MacBook showed activity from March 2026.
- The same backdoors were used in the KelpDAO LayerZero bridge attack.
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1204.002 Malicious FileT1102.002 Bidirectional CommunicationT1543.001 Launch AgentT1555.003 Credentials from Web Browsers
- Threat actors
- Jade Sleet
- Organizations
- SentinelOneGitHubMicrosoftLayerZeroSafe{Wallet}
- Countries
- North KoreaIndia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | hashicorp-aws.com | m.lock.hcl") pointing to malicious domains (e.g., "registry.hashicorp-aws[.]com") that causes the platform to download attacker-controlle |
From the original article
3 min read at thehackernews.com
The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.